In the context of the deep digitalization of the economy and the growth of cyber threats, information security is being transformed from a highly specialized technical function into a strategic element of corporate governance and risk management. The article provides a theoretical and methodological analysis of information security as a complex, multicomponent management object integrated into the overall management system of the organization. Based on international standards (ISO/IEC 27001), national legislation (Federal Law No. 149-FZ) and the work of leading researchers (B. von Solms, R. Baskerville) reveals the key characteristics of information security: sociotechnical nature, risk-orientation, regulatory burden and dynamism. The author systematizes five theoretical approaches to understanding information security in management optics — resource-oriented, risk-oriented, process (PDCA), sociotechnical and institutional — and based on them offers a structural and functional information security management model that includes three hierarchical levels (strategic, tactical, operational) and five basic management functions. Special attention is paid to the evolution of information security from the "first generation" (technical support) to the "second generation" (strategic integration into corporate governance, ERM, compliance and BCM). The article emphasizes that effective information security management in modern conditions is impossible without its understanding as a complex subsystem in which technological measures, organizational processes, the human factor and regulatory requirements act in a single management contour. The findings provide a theoretical basis for further empirical research in the field of ISMS maturity metrics, the impact of corporate culture on security, and the strategic positioning of information security in the digital economy.