Objective. The purpose of the study is to collect publicly available information to identify the main problems that hinder the effective management of information security risks in the business sector.Method. The following research methods are used: systematization, description and analysis. The necessary data are formed on the basis of information obtained from the analysis of the regulatory framework and research in the field.Result. In this paper, the relevance of the issue under consideration was substantiated; the significant effectiveness of the risk-based approach in information security management was noted. The key stages of the information security risk management process were described. Next, the main problems of information security risk management for all stages of the holistic process are identified.Conclusion. The conducted research is of an overview nature. The materials presented in the paper can serve as a basis for further research on the topic, as well as for the formation of recommendations for resolving the identified problems.