At a time society constant informatization, the rapid information technology development, increasing the number of new software products and information systems, the question of protection against unauthorized intrusions into information systems and data protection is acute. It is determined that IT audit is a key component of achieving quality work of the information system and a problem with professionals who are able to effectively, correctly and quickly support the information system from malformations and data security. The dynamics of cyberattacks on state information resources and the legal component of Ukraine cyber defense are analyzed. The problem of protection is raised by a very narrow circle of scientists. But the foundation for the development and implementation of IT audit is laid. In accordance with the legal field of Ukraine, special state institutions not only establish requirements for the information protection, but also conduct inspections of the systems security. Consideration of the international standard ISO / IEC 27001 gives an opportunity to see how the standards system works to support security of information systems, how an enterprise / organization of any ownership form will have a quality information protection algorithm and how IT audit of information systems. ISO / IEC 27001 provides a number of perspectives for the management of the enterprise / organization information security – identifies risks and applies controls to managing or avoiding of information threats; enhances flexibility in the adaptation management to all or some subsystems of the enterprise / organization; provides an opportunity to gain the customers interest and trust that their data is protected; shows the modernity and reliability of information system protection. It is the system of international standards and examples of companies such as ISACA groups that logically lead to the conclusion that conducting an IT audit is necessary for the management of information systems. The issue of training IT auditors, which must be certified and meet international standards, is acute.