Технологічні рішення застосування нормативної бази технічного захисту інформації

In modern conditions of rapid digitalization of management processes and data processing, the issue of ensuring reliable information protection in automated systems becomes critically important for state and private institutions of Ukraine. The regulatory framework of Technical Protection of Information (TPI), formed in the late 90s, lays down fundamental security principles; however, its practical implementation in the context of modern architectural solutions and dynamic threats often causes difficulties for specialists. The relevance of the study is driven by the necessity to harmonize the classic requirements of regulatory documents with modern technological approaches to building information systems, as well as the need to develop clear algorithms for implementing Complex Information Protection Systems (CIPS). The article is devoted to solving the problem of adapting theoretical legislative provisions to practical cases of deploying security systems. A comprehensive analysis of legal and regulatory acts in the field of TPI, particularly the classic requirements of regulatory documents 1.1-003-99, 2.5-004-99, and 2.5-005-99, was conducted. Based on this analysis, a complex of technological solutions and a practical method for implementing protection measures have been developed and presented. A step-by-step algorithm is proposed, covering all stages of CIPS creation: from information categorization based on confidentiality, integrity, and availability properties to the selection and configuration of functional protection profiles. Special attention is paid to the methodology for determining the class of an automated system depending on its architecture (local, distributed) and data processing mode. The process of integrating security requirements into the Software Development Life Cycle (SDLC) is investigated, allowing a transition from «superimposed» security to a «Security by Design» model. Recommendations regarding the implementation of administrative and discretionary confidentiality, integrity, and observability services are developed. A method for evaluating the effectiveness of implemented measures, based on a combination of documentation analysis, personnel interviewing, and instrumental testing of protection mechanisms, is also proposed. The results of the study confirm that the universality of the classic regulatory framework allows for its effective application in protecting modern systems, provided adapted approaches are used. The proposed approach enables organizations of various ownership forms and scales (from small enterprises to large distributed corporations) to build an economically justified and reliable protection system. The practical application of the developed technological solutions contributes to minimizing information security risks, ensuring compliance with legislative requirements, and increasing the general level of cyber resilience of the state’s information infrastructure.