Financial institutions, peculiarly banks, are extremely important for the stability and functioning of the economy of each country, but also of the entire global economy. Problems in the operations of some banks, especially those of systemic importance, can have significant consequences for the functioning of both, the national and world economies. Some of the vital problems that the banks face today are frequent cyber attacks on their infrastructure and information systems, and the serious consequences caused by such attacks. Given that today's banking business relies heavily on Internet communication with other business entities, banks are increasingly exposed to numerous security threats and imminent risks. Due to the lack of all relevant information and time and other resource constraints, it is often not possible to collect and process all the necessary information about an information system so that it can be adequately evaluated within an acceptable timeframe, which puts the organization into a state of increased security risk. So, one of the research questions defined was how to enable more efficient (in terms of cost and time) decision-making on the security status and selection of appropriate critical information systems in a financial institution? By studying the relevant literature and the existing models and techniques used in practice, it was found that there is no solution to the stated problem of multicriteria decision-making in conditions of risk in the domain of information security for business-critical IT systems. Thus, a model was proposed for more efficient decision-making on the security status of a critical information system by selecting the appropriate IT solution. The model was developed using the Design Science Research Methodology (DSRM). In order to create a new model, first, it was necessary to conduct a systematic literature review (SLR) of papers on the applicability of multicriteria decision-making (MCDM) methods in a domain of information security risk assessment. Such SLR was conducted with very rigorous inclusion and exclusion criteria. By discovering which MCDM methods are suitable for creation of a new model, it was necessary to conduct the next research phase in order to identify all the information security risk assessment (ISRA) criteria that are relevant for integration into a new hybrid MCDM model. The Delphi technique was used to conduct the research by examining relevant information security experts from various financial institutions. Upon receipt of appropriate feedback on ISRA criteria, it was necessary to conduct another research in order to discover mutual influences and dependencies between those ISRA elements. That was one of the crucial research phases in order to get criteria weights of ISRA elements. So, the most important elements for the analysis and assessment of information security risks were integrated into adequate methods for multicriteria decision-making. Generic criteria for risk analysis and assessment were used as evaluation criteria in the new multicriteria model for the purpose of evaluation, ranking and selection of critical business information systems. The model was validated in relevant case studies. By confirming hypotheses, the main goal of the research, i.e. making an informed decision on the security status of critical information systems in a financial institution and increasing the efficiency and quality of the assessment process and selection of such systems, was successfully achieved.