Every modern company must have a developed information system, which brings with it the security and protection of that system. It is very important for the company that the resources of the information system are available and that the data is confidential and reliable. In order to achieve this, it is necessary to introduce an information systems security management system in the company. In addition to the smooth running of the business, this system helps the company to be able to face threats and risks at any time and respond to the above. Over time, a number of standards have developed in the field of security and protection of information systems, the implementation of which the company achieves a number of advantages, among which are clearly defined frameworks of responsibilities, competencies and authorities in the information system. The standards are the result of safety requirements and are implemented in procedures in safety regulations and other documents. Their application is necessary for the responsible and successful implementation of security procedures and the quality of the company's information system. Since every company operates with certain risks, they are inevitable, but they can certainly be reduced to some appropriate level that is not dangerous for the company itself. It is therefore necessary to draw up a business plan by which the company will determine the procedures to be followed in cases of risk.