Model of formalized information security audit of an organization with a critical infrastructure facility for compliance with international security standards

Abstract

The article emphasizes the importance of conducting information security audits for information systems of critical infrastructure organizations. Effective protection is ensured by aligning security systems with international standards. The audit monitors and assesses compliance but remains effective only when performed regularly by trained specialists. Due to the routine nature of audits and wartime constraints, such as power outages and loss of communication, AI-based methods are often impractical. Therefore, the authors propose a temporary solution using formalized security assessment criteria with clear indicators for objective verification. The study develops a methodology for conducting audits aligned with international standards, addressing the lack of practical guidance in existing ones. It also analyzes global regulatory documents to identify typical management approaches and proposes an adaptable checklist-based methodology covering 10 key information security areas, particularly useful for organizations operating under wartime conditions. © 2025 Copyright for this paper by its authors.