Management of information security risks in a context of uncertainty

The article proposes a method for selecting the optimal tactics to reduce the current level of information security risks to an acceptable level specified by a decision maker based on the introduction of a metric of assessment characteristics of acceptable and current risks, as well as algorithms for constructing the acceptable risk curve and for determining the values of current information security risks.