- Home
- Business consulting in Kazakhstan
- Kazakhstan
- Software Certification and Security Testing in Kazakhstan
Software Certification and Testing in Kazakhstan
We help you work out which document your product needs, prepare the documentation and manage testing at an accredited laboratory until you receive the test report.
Software certification in Kazakhstan is not required for every product. The law requires cybersecurity compliance testing only for a specific list of systems: public sector information systems and websites, critical infrastructure, and private systems used to deliver public services. Other products are tested at the owner's choice. In practice, a test report or certificate is often requested by the registry of trusted digital objects and by large customers, especially in tenders.
Private systems are tested by accredited laboratories. Depending on the system, they check the source code, security functions, performance under load, network infrastructure and processes. A test report is valid for 3 years, but if the functionality, operating conditions or owner change, you need a new one sooner. You sign the contract with the laboratory directly, while we prepare the documentation, handle the correspondence and make sure the lab's comments reach your developers on time.
Who it is for
- Developers of systems and portals for government bodies and the quasi-public sector
- Companies that need a test report for the trusted software registry
- Vendors of solutions for banking, energy, telecoms, transport and healthcare
- Teams that used to rely on the ST-KZ certificate for tenders
- Companies with frequent releases whose test report is outdated because of new functionality
Requirements
- Testing is mandatory for public sector information systems and websites, critical infrastructure and private systems used for public services
- For other software, testing is voluntary
- Private systems are tested by an accredited laboratory
- For the registry, a test report under the approved methodology or a certificate under ST RK ISO/IEC 15408-3 at assurance level 4 or higher is accepted
- A test report is valid for 3 years, or 1 year for the e-government platform
- ST-KZ certificates have not been issued since January 1, 2026
What we do
- Map your requirements: mandatory testing, a test report for the registry or a certificate
- Compare accredited laboratories by scope of work and timelines
- Work with your team on the system description, architecture, list of security functions and infrastructure details
- Handle correspondence with the laboratory and pass its questions to your developers
- Turn the lab's findings into a task list and arrange the retest
- Track the test report's validity and, if needed, prepare the registry application in parallel
Key documents
- A description of the system under test and its purpose
- System architecture and infrastructure details
- A list of security functions
- Source code or access to it, if code analysis is part of the testing
- Documents on product rights and on the customer, if testing is mandatory
- The contract with the chosen laboratory
How it works
- Briefwhat the product is, who the customer is, where it will run and why you need the document
- Requirements mapwhich testing or certificate you need, where to get it and which documents to prepare
- Documentation and applicationwe assemble the package with your team and apply to the laboratory
- Testingcode, security functions, load, network and processes; you agree the timeline with the lab
- Test report and next stepsyou receive the report; if it is needed for the registry, we move on to the application and track its validity
Timeline
Testing timelines are set by the laboratory; the test report is valid for 3 years or until the functionality changes.
Timelines are approximate: government agencies, consulates and banks set them.
What to watch out for
- A positive test report depends on the product and the laboratory's findings, and nobody can promise it in advance
- Updated functionality requires a new test report, even if 3 years have not passed
- For the registry, the document must be valid on the filing date, otherwise the application is rejected
- In mandatory testing, the application is filed by the system owner or its authorized representative, which needs to be agreed with the customer early
FAQ
How much does it cost?
Our service fee is on request. Government fees, translations, insurance and other mandatory costs are paid separately; we send the full estimate before you sign.
Is software certification in Kazakhstan mandatory?
Not for all software. Cybersecurity compliance testing is mandatory for public sector systems and websites, critical infrastructure and private systems used for public services. Other software is tested at the owner's choice, most often to get into the registry of trusted digital objects or to win a tender.
Who carries out cybersecurity testing of software?
Private systems are tested by accredited testing laboratories, while government systems are handled by the state technical service. We help you choose a laboratory, and you sign the contract with it directly.
What is checked during testing?
It depends on the system. Usually it includes source code analysis, a check of cybersecurity functions, load testing, an assessment of the network infrastructure and a review of security processes.
How long is a test report valid?
3 years, or 1 year for the e-government platform and its products. If the functionality, operating conditions or owner change, a new report is needed before the term ends.
Can I still get an ST-KZ certificate for software in 2026?
No. ST-KZ certificates were issued until January 1, 2026. Now software made in Kazakhstan is treated as a Kazakhstan-origin product through the registry of trusted digital objects, which requires a test report or a certificate under ST RK ISO/IEC 15408-3.
We won a tender from a state-owned company. Where do we start?
Systems and websites of the quasi-public sector go through mandatory testing. We agree with the customer straight away on who will be the applicant and build testing into the project plan, so it doesn't push back delivery.
Do you guarantee the result?
No. Decisions are made by government agencies, consulates and banks. We are responsible for preparing and checking documents, filing and support, and we tell you about the risks upfront.
Related programs
Let’s discuss your case
We will check whether the program fits your citizenship, income and family, and send an estimate with the full list of costs.
