The work is devoted to solving the problem of harmonizing the regulatory legal framework on Information Security and Protection for EMERCOM of Russia, which required creating an appropriate methodology. The main contradictions of subject area in the categorical analysis notation are shown, namely between: obsolescence and updating of the regulatory legal framework on Information Security and Protection; normative legal documents quantity and quality; global/national and departmental/state interests in the infosphere. It is hypothesized that all the identified contradictions are not antagonistic and, therefore, their mitigation can be subject of harmonization. The harmonization principles have been synthesized, which can act as (principled) requirements to methodology and special information technology for solving applied harmonization tasks of the regulatory legal framework on Information Security and Protection. First, scientific validity principle, in the sense of systematicity, logicality, necessity and sufficiency, formalisability, unambiguity and reliability. Secondly, realisability principle, in the sense of determinacy, effectiveness and massiveness, as well as the tools availability. Thirdly, extensibility principle, in the sense of the applied problems pool and methods of their solution. Fourthly, pragmatism principle, in the sense of a basis for developing evidence-based proposals and recommendations for harmonization. It has been found that there is no (or no known) methodology suitable for solving such a large and difficult to formalize task as harmonizing of the regulatory legal framework on Information Security and Protection. The harmonization notion of the regulatory legal framework is defined in a broad and narrow sense. For the latter, the objectives are defined: primary – comparability, secondary – establishment of equivalence in form/content and identity. A formalized record of such harmonization idea and its secondary aims is given; primary is understood through the ontology of subject area and is achieved by the essence alphabet unity of normative legal documents markup. A methodological scheme for harmonization of the regulatory legal framework on Information Security and Protection is proposed in the form of a logically linked (by initial data and results) stages sequence. An example of proposed methodology workability is given and a replenishable pool of the regulatory legal framework on Information Security and Protection harmonization applied tasks for EMERCOM of Russia is defined. Conclusions are drawn regarding the novelty and practical significance of the results obtained, as well as directions for further research.