Audit of Efficiency of Information Security in Conditions of Digital Economy

Audit of efficiency of information security (IS) is a new type of audit in Russia, which is gaining popularity due to the development of information technologies and the increasing number of cyber attacks. At the same time, this process is poorly consecrated in scientific articles and there are a number of problems associated with the performance of audit process, requiring consideration and finding solutions. The purpose of this work is to collect and systematize data on the features of the audit of efficiency of IS, as well as develop information and methodological support for it, which will provide quantitative estimates of the level of information system security in the face of internal and external threats and develop countermeasures to counter cyber attacks. This paper discusses the main features of the audit of efficiency of IS through the analysis and systematization of data from various Russian regulations, international standards for IT audit, articles of Russian and foreign authors on audit and analysis of IT effectiveness. On the basis of these data, the author developed a methodology for audit of efficiency of IS, consisting of 8 steps, and carried out its approbation using the example of a company. It was also theoretically substantiated and built a model of dependence of the probability of IS threats on the financial and organizational indicators of the company, which made it possible to draw a portrait of the company, the risk of which IS threats from cyber criminals is most likely in the digital economy.