The article presents practical recommendations and a mechanism for justifying investment in information security for business enterprises. The scientific and practical approach to this problem is analyzed, the main economic methods of investment justification are given. A methodology for justifying investments in information security is proposed, based on the assessment and probability of the implementation of threats to information security and the total cost of costs for eliminating the consequences of the implementation of threats.