CONCEPTUAL MODEL OF INFORMATION SECURITY AUDITOBJECT

The holder of information to protect the information must identify and manage numerous activities to ensure information security. The efficacy of decisions depends on the completeness, reliability and timeliness of information on the situation of information security, which is extracted in the course of the audit. Currently, the information security audit is carried out on the basis of generalization of empirical knowledge and experience, which are enshrined in practical recommendations and standards. However, the achievements of fundamental science for these purposes are not applied in full, in the absence of theoretical research in this area. The article presents a conceptual model of audit that contains aggregated and detailed diagrams and formal statement of task: conclusion of the audit evidence and the conversion of audit evidence in the audit report. Finally, it provides recommendations for the practical application of the results obtained and directions for further research.

аудит информационной безопасности, аудиторский риск, аудиторское свидетельство, аудиторское доказательство, аудиторское заключение