Critical infrastructure enterprises failed to switch to domestic software

On September 1, 2025, amendments came into force in Russia, obliging critical infrastructure facilities to use only software included in the register of domestic software. However, according to the Ministry of Digital Development, the Bank of Russia, the Ministry of Energy and the Ministry of Transport, the actual transition to Russian software has not yet taken place, as the authorities continue to coordinate the details.

According to the new requirements, critical infrastructure facilities, including communication networks, information systems of state bodies, as well as companies from the energy, financial and other industries, must use only domestic software. However, as a representative of the Ministry of Digital Development noted, the transition deadlines will be determined by a separate government document, which must be adopted no later than April 1, 2026.

Currently, ministries are working on categorizing objects in various industries. The FSTEC is developing a list of typical critical information infrastructure facilities, which already includes more than ten items. Also, the Bank of Russia, together with the government, is developing a procedure and timeline for the transition to domestic software for financial organizations.

A representative of the Ministry of Energy said that companies in the energy sector had already begun the process of import substitution before the amendments were adopted. He stressed that with the entry into force of the new requirements, they will be subject to the same obligations as other industries. The Ministry of Transport is also working on approving a list of typical critical information infrastructure (CII) facilities.

The Law on CII, adopted in 2017, obliges owners of critical infrastructure to determine the significance of their facilities and comply with security requirements. With the recent amendments, this obligation has passed to the state, which should simplify the process of categorization and transition to domestic software.

Read more on the topic:

Research: 95% of Russia's critical infrastructure depends on foreign software

State Duma approved the law on the status of data centers as critical infrastructure facilities

A new critical infrastructure protection system has been developed in Russia