Methodology for the creation and implementation of an information management security system at an industrial enterprise
The article discusses aspects of creating an information security management system, business processes using various tools and mechanisms. Information security issues are vital to the successful functioning of a modern company or enterprise. The information security management system (ISMS) is a certain part of the overall quality management system, based on the approach to assessing business risks for the creation, implementation, operation, and information security in general. Improving the quality of information security, improper management of large amounts of data affects the functioning of the enterprise, its productivity and functionality. Thus, enterprises must compare risk management principles to create a robust ISMS. An indispensable element on the path to creating an integrated ISMS is the ISO / IEC 27001 standard (GOST R ISO / IEC 27001 "Information technology." (GOST R ISO / IEC 27001 "Information technology. Methods and means of ensuring security. Information security management systems. Requirements"). The authors propose requirements for an information security management system (ISMS), including a general methodology for creating, implementing and evaluating the effectiveness of ISMS mechanisms. The two most well-known ISMS implementation standards, ISO / IEC 27001: 2013 and ISO / IEC 27005: 2018, have been reviewed and there is now an increased interest in these standards from organizations in various industries. Compliance is becoming an important factor in the commercial success of the company due to a number of benefits that it receives. A process approach was applied to building ISMS and risk management based on these standards.