COMPARISON OF MATURITY MODELS OF INFORMATION SECURITY PROCESSES OF AN ORGANISATION (COMPANY)

Abstract

Background. The increase in malicious activity in the information and cyberspace poses a challenge to the leaders of enterprises (organizations) and the leaders of companies with additional tasks and benefits to protect their assets. The loss of assets, for example, financial or technological, can make it impossible for the company to achieve its basic function - to generate profits. Methods. The work used the information security risk analysis method. Results. Сreation and promotion of current information security systems. Organizations spend significant financial resources on the development and operation of technology protection, create various structural subdivisions, such as the assessment and provision of a similar level and information security of the enterprise (company). At the same time, there is a real risk of the current situation if malicious and more current technologies are able to rig the system to protect the company and cause irrevocable costs, both financial and reputational. Сonclusions. One of the main directions of this problem is the creation of an information security management system (ISMS), which is a warehouse management system for an organization (company) and is assessed without bears the risks of creating, implementing, operating, operational monitoring, review, support and thorough information security organizations (enterprises). The ISMS includes the organizational structure of the organization (company), its policies, nutritional planning, monitoring of labor costs, promotion of daily practices, control and support of resource processes. As a best practice, to assess the level of information security of an organization, it is recommended to use a different approach that is based on the capabilities of process maturity models. The extracted results can be used to thoroughly and optimize the created information security system of the organization (company). There are currently a wide range of information security maturity assessment models available to organizations based on similar principles. In this case, it is realistic to select such models to be limited, first and foremost through a weak connection to the characteristics of specific organizations. The work examines models of the maturity of processes, their structure and the ability to evolve in the course of assessing the level of information security.