The article is devoted to the assessment of information security risks in automated systems of class "1". An adapted approach to the assessment of information security risks in such automated systems using the Methodology and requirements of the standards of GSTU SUIB 1.0 / ISO / IEC 27001: 2010 and GSTU SUIB 2.0 / ISO / IEC 27002: 2010 is proposed. The efficiency and methods of implementation of the approach are proved on the example of consideration of real threats and vulnerabilities of class 1 automated systems. The main requirement for the creation of information security management system in the organization is risk assessment and identification of threats to information resources that are processed in information and telecommunications systems and speakers. The basic standards on information security in Ukraine are considered, which give general recommendations for the construction and assessment of information security risks within the ISMS. The most common methods and methodologies for assessing information security risks of international standard are analyzed, their advantages and disadvantages are identified. The order of carrying out of works on an estimation of risks of information security of the AS of a class "1" is defined. The vulnerabilities considered by the expert according to the standard ISO/IEC 27002:2005 and the Methodology are given. A conditional scale for determining the impact on the implementation of threats to integrity, accessibility, observation is given. Measures and means of counteracting the emergence of threats are proposed. This approach can be used both for direct information risk assessment and for educational purposes. It allows to get the final result regardless of the experience and qualifications of the specialist who conducts risk assessment, with the subsequent implementation and improvement of the existing risk management system in the organization.

For several years in a row, Ukrainian organizations (first due to the Covid-19 pandemic and its consequences, and now military operations) and in general the world, have been forcibly transferring employees to a more optimal work format - this is remote work (work at home). According to statistics, this practice has shown its positive side in terms of higher labor productivity (less time spent on moving around the city, comfortable home conditions, etc.), however, from the point of view of cyber security, there has been an increase in cases of cyber threats (hereinafter - cyber threats) and the activation of cyber criminals. Remote work mode means full or partial transition to the use of personal devices by employees. Setting up remote work of employees requires a clear preparation of information systems within the organization, therefore information security (hereinafter - IS) and information technology (hereinafter - IT) services must ensure the security and continuity of the organization's business processes. Because remote work is associated with a high risk of cyber threats and the intervention of cybercriminals. Cybernetic threats (cyberthreats) are existing and/or potentially possible phenomena and factors that pose a danger to the vital interests of a person and citizen, society and the state, the implementation of which depends on the proper functioning of information, telecommunication, and information-telecommunication systems [1]. The formation and effective implementation of cyber security, within the framework of which a set of recommendations and measures for predicting and countering cyber threats is developed, is a necessary condition for the safe and continuous functioning of the organization.