System and method for determining enterprise information security level

A system or determining an information security level for an enterprise, the system comprising:

• a hardware processor;
• and
• a memory storing a software program that, when executed by the hardware processor, causes the hardware processor to:
• collect data relating to a structure of the enterprise including a plurality of elements, the plurality of elements including equipment and control systems for the equipment of the enterprise;
• create a model of an operation of the plurality of elements of the enterprise based on at least one function of each element that is determined from the collected data;
• identify criteria to evaluate the operation of the plurality of elements based the at least one function of each element;
• determine a coefficient indicating a functional effectiveness of the plurality of elements of the enterprise based on the identified criteria;
• simulate control of the enterprise by applying different sequences of events and actions to increase or decrease the coefficient, where the different sequences of events and actions are based on previous events for one or more simulation iterations using the at least one function of each element;
• and
• determine an information security level for the enterprise based on a value of the coefficient in response to the simulated control of the enterprise by applying the different sequences of events and actions.

A computer program product stored in a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for determining an information security level for an enterprise, including instructions for:

• collecting data relating to a structure of the enterprise including a plurality of elements, the plurality of elements including equipment and control systems for the equipment of the enterprise;
• creating a model of an operation of the plurality of elements of the enterprise based on at least one function of each element that is determined from the collected data;
• identifying criteria to evaluate the operation of the plurality of elements based the at least one function of each element;
• determining a coefficient indicating a functional effectiveness of the plurality of elements of the enterprise based on the identified criteria;
• simulating control of the enterprise by applying different sequences of events and actions to increase or decrease the coefficient, where the different sequences of events and actions are based on previous events for one or more simulation iterations using the at least one function of each element;
• and
• determining an information security level for the enterprise based on a value of the coefficient in response to the simulated control of the enterprise by applying the different sequences of events and actions.