Practical Aspects of Information Security Auditing in Compliance with Information Security Standards of the Russian Banking System (Viewpoint)
The publication deals with some methodological aspects of conducting audit for credit institutions of the banking system in the Russian Federation in accordance with the STO BR IBBS standard requirements (version 2014). It is noted that in the evaluation process (or self-assessment) credit institution can generate numerical indicators of the level of information security with the required frequency. In addition, on the basis of numerical indicators formation become possible planning strategic (tactical) level improvements and identifying areas that require priority changes. An important factor is the possibility of modeling the priority of changes in the selected areas in order to provide the best performance of the M1 - M34 metrics with minimal expenses (both organizational and/or technical). The proposed approach allows to respond the modern IT-Security threats and improve the IT-Security assessment process (self-assessment).