Abstract: The article analyzes the criteria for assessing the security of information circulating in information, telecommunication and information and telecommunication systems of the enterprise. Such analysis is aimed at identifying and forming a minimumnecessary and sufficient functional profile of information security at a particular enterprise as a whole, as well as in the process of implementing individual business processes. Special attention is paid to the profitability of implementing the selected security profile, that is, to the ratio of losses that can be caused by the leakage / loss of a particular information to the expenses necessary for the implementation of the respective security profile. The article analyzes in detail the criteria of confidentiality, integrity criteria, accessibility criteria and criteria for the observation of information that circulates in information and telecommunication systems, as well as requirements for architecture, development environment, design process, environment, documentation and testing of the complex of facilities, that make up the warranty criterion. Particular attention is paid to the fact that the implementation of some security services is a prerequisite for the implementation of other services, so there are services without which it is impossible to implement a system of access delimitation, to implement functions that require the appointment of a system administrator, in particular administrative delimitation of access and to implement the service of integrity of the complex of means protection, which is also mandatory. In addition laid the groundwork for further research on the formation of information security policy at the enterprise, taking into account the profitability of implementing certain measures.