Information Security Risk Assessment of Commercial Organizations

The main purpose of any commercial organization is to make a profit. The reduction of expected losses can be interpreted as profit, and taking into account the cost of implemented countermeasures, this value can be considered as a return on investment in measures to protect the information system of the organization. The information security risk assessment procedure allows you to systematize information security risks, plan the scenario of their processing, correctly and effectively specify countermeasures that eliminate these risks. The article deals with the model of information security risk assessment of commercial organizations, based on two-factor risk assessment. The concept of the level of information security of commercial organizations as a visual indicator of the state of information security of the organization for its management is considered.