What is GTS certification?
Certification of state technical facilities is a mandatory procedure for verifying the compliance of information systems of government agencies and the quasi—public sector of the Republic of Kazakhstan with the unified information security requirements. It is regulated by the Law “On Informatization”.
Who needs it
State bodies — central and local executive bodies.
Quasi—public sector – national companies, holdings, and subsidiaries.
Critical infrastructure operators.
Stages of certification
1. GAP analysis
Inventory of assets, assessment of current protection, a list of measures to eliminate comments.
2. Documentation development
Information security policy, threat model, technical specifications for the protection system, regulations, continuity plans.
3. Implementation of technical means
Firewalls, SIEM, DLP, antivirus, cryptographic protection, access control.
4. Testing
Internal checks and a pentest. Registration of test reports.
5. Certification tests
Verification by an accredited body. Issuance of a certificate or prescription.
The average period of preparation for GTS certification is from 3 to 6 months.
Typical errors
Formal documentation is templates without reference to real processes.
There is no threat model — it must take into account the specifics of a particular system.
Uncovered vulnerabilities in system and application software.
There is no logging — there is no centralized collection of logs.
