At present, the significance of information security is fully recognized, both globally and locally, nationally and corporately. But it is driven by many and different global regulatory frameworks and local laws. For example: the ,,ISO27k” suite, which comprises more than seventy standards, about fifty of which have been published so far, series of about 200 special publications NIST SP 800, various laws regarding the protection of personal data, copyright and related rights, GDPR etc. At the same time, the standards and regulations specify requirements in general and say what do you need to do, but they do not say how to do it, how to implement these multiple and various requirements in practice. The present work comes to elucidate this topic, becoming today one of the hottest.