MECHANISM FOR ADAPTIVE PLANNING OF ENTERPRISE CYBERSECURITY AUDITS BASED ON COMPREHENSIVE ASSESSMENT OF ASSET SECURITY STATE AND CRITICALITY

Abstract

The article proposes a mechanism for adaptive planning of enterprise cybersecurity audits based on a comprehensive assessment of the security state and criticality of information assets. The mechanism is considered as a decision-support tool for the audit planning stage and is intended to determine the priority of information asset checks within an established audit program. The comprehensive assessment combines formal compliance with cybersecurity requirements, the current dynamic security state, and expert assessment performed by an auditor or a relevant specialist. Asset business significance is additionally represented by a criticality coefficient. Based on these indicators, an integrated asset security-state score is formed and an audit priority index is calculated. The index is used to rank information assets and adaptively refine the order of their checks when audit resources are limited. The mechanism allows priorities to be recalculated when new vulnerabilities, anomalous events, incidents, configuration changes, or other cybersecurity risk factors occur. To ensure reproducibility, the sources and timing of input data, normalization rules, assessment scales, and weighting coefficients are documented. A scenario-based evaluation was performed using eight information assets of a hypothetical enterprise. After the deterioration of the security state of selected assets was modeled, the priority indices were recalculated, resulting in a change in the order of first-priority checks. With the available audit resource limited to three checks per cycle, the mean priority index of the assets selected for first-priority examination increased from 0.307 for the initial order to 0.344 for the adaptively updated order. The obtained results demonstrate the operability of the mechanism as a decision-support tool for prioritizing information asset checks and require further validation using real enterprise data.