The most relevant and widespread type of information that almost all organizations of the Russian Federation work with is personal data. Because of their prevalence, they require special vigilance in their processing and security. Information systems processing personal data may be subject to various attacks due to certain vulnerabilities. To ensure maximum protection of the personal data information system, the Federal Service for Technical and Export Control has developed a special methodology for determining the current threats to the information system. In order to reduce the expert's labor in assessing each threat, the automation of this process will be relevant, which in the end will not only give a gain in time, but also reduce the number of errors associated with the human factor.