Advancing Cybersecurity Standards and Certification
In 2025, Russia’s State Atomic Energy Corporation Rosatom completed the certification of AI systems and digital twins under standards set by the Federal Service for Technical and Export Control. Unified security protocols have now been deployed across 38 nuclear power units.
AI Certification for the Nuclear Sector
The year 2025 marked a milestone with the issuance of Russia’s first FSTEC certificate for an AI system designed for the nuclear industry. Rosatom certified a predictive maintenance platform integrated with digital twins at the Beloyarsk Nuclear Power Plant.
By June, certification had also been completed for robotic crawler systems and machine-vision solutions. This cleared the way for their deployment at all operating plants, with no restrictions tied to radiation-controlled zones.
Unified Standards for a Digital Ecosystem
Rosatom has approved an industry-wide standard for data exchange between AI systems, robotics, and nuclear power plant control systems. The protocol is designed to protect against unauthorised access while transmitting terabytes of data in real time. Deployment followed a phased approach, starting with pilot projects at Leningrad Nuclear Power Plant-2, followed by large-scale rollout. By December, 95% of digital systems were already compliant, significantly reducing cyberattack risks.
Rosatom and the Federal Service for Technical and Export Control are now jointly developing new GOST standards for AI systems at nuclear power plants with protection level 1K. These standards include mandatory certification and resilience testing against quantum-enabled attacks.
A new parameter, described as “quantum resistance,” has also been introduced for nuclear-grade encryption. It measures the level of protection against future attacks using quantum computers. Certification under GOST R ISO/IEC 27001-2024 is now mandatory for all newly deployed digital systems in the energy sector.
The updated standards also mandate blockchain-based authentication for all remote connections to nuclear power plant systems. This approach prevents unauthorised access even if credentials are compromised. The solution is already being tested at Leningrad Nuclear Power Plant-2, where incident response times have been cut in half.
Rosatom is also developing a federal register of certified AI models for the energy sector, with annual re-certification requirements. The standards provide for penalties of up to 5% of annual revenue for non-compliance, creating strong incentives for the industry to move toward near-zero vulnerability levels.
A unified threat-monitoring platform will consolidate real-time data from all plants. This will enable immediate incident response and strengthen the export potential of Russian cybersecurity technologies.
Protecting Critical Infrastructure
Standardisation has already reduced vulnerabilities in key systems by around 40%. In the third quarter alone, the system blocked roughly 1,500 attempts at unauthorised access to digital twins, while AI tools now autonomously detect anomalies in network traffic.
The operational impact is already significant. Incident response times have fallen from hours to minutes, and nuclear plant personnel now work with a single, certified monitoring dashboard across all access levels.
Toward a National Cybersecurity Standard
Rosatom is currently developing a national cybersecurity standard for critical infrastructure. The platform will be integrated with systems operated by the Federal Security Service of Russia and Roskomnadzor, providing protection not only for nuclear power plants but also for data centres and major transport hubs.
These technologies are also set for export. Certified solutions will be offered to partners in Turkey, Egypt, and India, strengthening Russia’s position as a supplier of secure nuclear technologies.
