The article discusses the main problems and, accordingly, the security measures taken by executive authorities, which define goals and objectives, risk assessment. The basic principles of the choice and implementation of protective measures, the development of information security procedures and policies are considered, the main domestic information security management systems are proposed, the main forms of employee training, monitoring and actions taken based on the analysis of monitoring results are also described. The stages of incident analysis in the process of incident investigation are defined, which allow identifying vulnerabilities and problems in the security system and taking measures to eliminate them. The regular updating and improvement of the security system is due to the provision of more reliable protection against various types of threats, several recommendations are given for the revision and adaptation of information security policies in order to adapt to changing conditions and requirements. The reasons for the expediency of implementing information security management systems are given.