REGULATORY FRAMEWORK FOR THE DEVELOPMENT OF AN ORGANISATION'S INFORMATION SECURITY MANAGEMENT POLICY

Abstract

The article deals with the problem of imperfection of regulatory documents in terms of revision of the main regulatory legal acts, their updating in accordance with changes and trends in the protection of information resources. The author emphasises the need to improve the compliance of organisations with due regard for the active digitisation of services in Ukraine, integration into the global digitalised space, as well as the active use of information and communication technologies, and expansion of the range of services in the field of electronic communications, which are the reasons for new attacks on enterprises. The author emphasises that these trends necessitate strengthening the protection of information flows of organisations (against unauthorised access, leakage of confidential data, loss of information assets, dissemination of intellectual property, dissemination of information constituting a trade secret) on the basis of a reliable regulatory framework. The article provides definitions of the following concepts: “information security policy”, “information security policy”, “bank information security policy”, and the resources that are the objects of dissemination of the organisation’s information security policy are presented. The authors have thoroughly monitored the regulatory and legal documents and identified the main regulatory documents on ensuring information security of organisations, namely: laws, regulations, resolutions, international standards, presidential decrees regulating cybersecurity and information protection of organisations operating in the financial sector. The results of the monitoring of documents and their summary are considered as the basis for the formation of compliance enhancements and the possibility of their implementation in the practical activities of banks in the development of information security management policies by cybersecurity specialists (chief compliance officer (CCO) and chief information security officer (CISO)).