In November 2022, the Government of Kazakhstan approved¹ a new version of the criteria for classifying information-communication infrastructure objects as “critically significant” (CSOISI, КВОИКИ in Russian).

Now, almost any IT or telecom company working with personal data of limited access, may fall within the regulation aimed at strengthening cybersecurity in organizations.

Previously, we addressed the adoption of a new law that provided grounds for the recognition of any private company as an owner of CSOISI objects. That could have entailed the need to comply with numerous requirements on ensuring information security—transferring backup databases to authorized bodies, conducting an annual audit of cybersecurity, a mandatory procurement of services from cybersecurity centers and other additional expenses for business.

Now, the CSOISI criteria are clarified and narrowed—under the new edition of it, companies providing “information-communication services” can be recognized as CSOISI owners. Such services include software publishing, computer programming, website activities, hosting renting, etc.

In this regard, any IT and telecom companies that retain personal data of limited access on its websites or services, may be recognized as owners of CSOISI objects. 

We carefully monitor all amendments to personal data and cybersecurity legislation and will continue to keep you updated.

1. RK Government Decree No. 849 dated 26 October 2022