METHODS OF INFORMATION SECURITY RISK MANAGEMENT: ISO/IEC 27001 AND CIS CRITICAL SECURITY CONTROLS

Abstract

Information security risk management methods based on two key standards, namely CIS Critical Security Controls and ISO/IEC 27001, are an essential part of a modern approach to ensuring the security of information systems. The analysis and study of these standards in the context of minimizing information security risks are crucial stages in the digital environment. During the writing of the article, a theoretical method was used, specifically the analysis of scientific research and publications related to risk management. The use of this methodological approach allowed a comparative analysis of ISO/IEC 27001 and CIS Critical Security Controls. CIS Critical Security Controls define 18 key control measures for the effective protection of information resources, covering aspects such as monitoring, protection against cyber threats, authentication and other security aspects. ISO/IEC 27001 provides a high-level framework for risk management, establishing security policies and audit procedures. CIS Security Controls, on the other hand, focus on specific actions and control points to ensure security. The pros and cons of both standards are analyzed, demonstrating their applicability in different contexts and in the face of modern information security threats. The use of these standards enables effective risk management under the conditions of modern threats and ensures the reliability of information systems. Their widespread use in commercial enterprises and government institutions demonstrates their universality. This article examines the pros and cons of both approaches. In the context of the increasing number of cyber threats and the importance of information security, both standards prove to be valuable tools, but have their limitations.