Baku: The initial stage of assessing the security status of Azerbaijan’s critical information infrastructure has been completed.
According to Azeri-Press news agency, the State Security Service, tasked with overseeing the security of critical information infrastructure and combating cyber threats, has conducted a series of measures to verify compliance with established regulatory legal acts. These measures, alongside the challenges encountered and the solutions proposed, were deliberated upon during a meeting of the relevant Commission.
The report highlighted that representatives from both the State Security Service and the State Service for Special Communications and Information Security participated fully in the meeting. Discussions were held in a collegial manner regarding the results of the initial assessments, revealing that several shortcomings in some critical infrastructures had been addressed. The discussions led to the establishment of new targets aimed at strengthening the resilience of the country’s critical information infrastructure against modern cyber threats. The meeting also considered inspections to be conducted by the Commission to ensure compliance with security requirements across critical infrastructure entities, following a plan approved by the authorized body.
In addition to the primary agenda, the meeting covered various other issues pertinent to the security of critical information infrastructure. The importance of enhancing general security requirements and continuously updating the list of critical infrastructure objects, factoring in risks and modern cyber threat models, was emphasized in alignment with international practices such as NIS-2 and CSF 2.0. Proposals for additions and modifications to the list of critical infrastructure objects, including industrial control systems (SCADA), were deemed necessary for safeguarding national interests. Strengthening oversight of compliance with security requirements was also a key topic of discussion.
The discussions underscored the significance of regular identification and assessment of security risks within critical information infrastructure. Calculating the financial implications of these risks and integrating them into management strategies was highlighted as crucial. Additionally, reducing reliance on services from legal entities that fail to meet cybersecurity requirements was stressed as a priority for ensuring the security of critical infrastructure facilities.
The National Cyber Center’s role in exchanging information with relevant entities using cryptographic protection tools was acknowledged, with an emphasis on further enhancing this practice in line with industry standards. The Commission is tasked not only with organizing inspections to ensure compliance with security requirements but also with evaluating corrective measures taken by infrastructure entities, preparing periodic reports, and promptly addressing serious shortcomings or critical security incidents in accordance with regulations.