infocert.kz

What It Is

InfoCert (ТОО «Инфосерт») is an information security certification and testing service provider based in Kazakhstan. Its website focuses on services such as software certification, testing of information systems and informatization objects, certification of program documentation against security requirements, and vulnerability analysis. It is not positioned as a traditional security product vendor, but rather as a professional services organization for compliance, certification, and third-party testing.

Core Capabilities and Compliance

In terms of protection and assessment coverage, InfoCert offers source code analysis, security function testing, load testing, network infrastructure inspection, information security process reviews, known-vulnerability scanning for servers/virtual resources/network equipment, and false-positive analysis. For software certification, its services are based on СТ РК ИСО/МЭК 15408 and can verify security functions according to evaluation assurance levels. It also provides software quality indicator checks under ГОСТ 28195 and evaluation of cryptographic protection tools under СТ РК 1073. In terms of qualifications, the site states that it is a certification body for software and databases, certificate number KZ.O.02.E1186, and that it operates an accredited testing center, certificate number KZ.T.02.E0995.

Deployment, Management, and Delivery

The service is primarily delivered as project-based testing. Applicants need to submit physical application documents, questionnaires, technical assignments or specifications, source code, information security technical documentation, and other materials. Testing may be carried out in the target system’s normal operating environment, with personal data replaced by virtual data. Deliverables mainly include test protocols, reports, compliance/non-compliance conclusions, and remediation recommendations. The website does not show an online console, continuous monitoring, automated alerts, API access, or SIEM integration, making it better suited to periodic certification and assessment than to continuous operational security protection.

Pricing and Support

Pricing is not publicly disclosed, and contracts are executed in accordance with the Civil Code of Kazakhstan and relevant rules. One useful detail is that if an applicant fixes non-conformities and requests retesting within 20 business days after receiving the test protocol, the provider will retest the corresponding items free of charge within 15 business days. Support channels shown include a Telegram channel and WhatsApp, but no SLA, hotline, or multilingual support details are disclosed.

Pros, Cons, and Best Fit

Its strengths are clear qualifications, strong alignment with Kazakhstan’s local regulations and testing rules for e-government and critical infrastructure, and a fairly complete testing scope covering code, networks, and processes. Its weaknesses are non-transparent pricing, limited information on online delivery and integration capabilities, and insufficient clarity around coverage of widely used international compliance frameworks. It is best suited for Kazakhstan-based software vendors, government agencies, organizations related to critical information and communications infrastructure, and entities that need local software/database certification.

Access from China and Alternatives

Access from China cannot be determined from the available website content, and payment methods are not disclosed. If a Chinese company is delivering government, financial, or critical infrastructure-related systems in Kazakhstan, InfoCert could be considered as a local compliance assessment partner. If the target market is only China, it would generally be better to prioritize domestic MLPS assessment agencies, commercial cryptography testing organizations, software testing centers, or local penetration testing and vulnerability scanning providers.