Optimization of the structure of the information system of personal data of critical information infrastructure objects based on risk theory

Objective. The purpose of the study is to reduce the actual risks of information security of important assets based on the analysis and systematization of significant deficiencies identified as a result of the ISPDn information security audit in twenty CII organizations. Method. Generalization and analysis of the results of the control and supervisory activities of ISPs of CII facilities, identification of the most dangerous threats based on risk theory. Result. Dangerous threats to the information security of CII facilities have been identified, and solutions have been proposed to enhance the security of ISPs by changing the topology, increasing the security of the server with PD through network segmentation, multi-level traffic filtering and integrated monitoring. The effectiveness of the proposed measures has been calculated. Conclusion. Dangerous typical threats to the information security of CII facilities have been identified, and solutions have been proposed to enhance security in personal data information systems.