STRATEGIC GUIDELINES FOR THE DEVELOPMENT OF THE INFORMATION SECURITY SYSTEM FOR BUSINESS ENTITIES

Abstract

The purpose of the article is to substantiate the strategic guidelines for the formation and development of the information security system of small business entities in the context of digital transformation and growing cyber threats. The relevance of the study is due to the increased vulnerability of small businesses to information risks due to limited resources, low staff awareness and the lack of systematic approaches to information security management. The need to develop an adaptive and economically sound strategy for protecting information assets for this segment of entrepreneurship is extremely relevant in the modern economic and digital context. In the process of the study, methods of systemic, structural-functional and comparative analysis, elements of SWOT and PESTEL analysis were used to assess the external and internal environment, as well as expert modeling to determine the levels of maturity of information security of enterprises and the corresponding strategic approaches to managing them. The methodological basis is supplemented by the logic of strategic management and the principles of risk-oriented thinking. The result of the study was the development of a level classification of the state of information security of small business entities and IS support strategies corresponding to each level. A structured model of strategy formation is proposed, which includes defining a mission and vision, analytical assessment of the environment, formation of SMART goals, strategic initiatives, resource provision, monitoring of effectiveness and change management. The article also reveals the main areas of improvement of the organizational and economic mechanism for IS support, taking into account the real capabilities of small businesses. The practical value of the article lies in the possibility of using the results to develop effective information security strategies at the level of small businesses, which will contribute to reducing information risks, increasing the level of trust from partners and clients, as well as integrating information security into the overall business strategy.