关键词: 信息安全，风险管理，方案决策，绩效

Abstract: Analyzed the situation and likely problems of the current risk management through affirming the current risk, combined with analysis of financing final accounts, and then put forward a systematic and normative differentiating model for the efficiency of risk management to distinguish the risk management projects from which found out the optimal one. Then pointed out the link between the investment of risk management and the loss of security incidents through further analyzing base on business, and gave out the verification of its effectiveness. The result of verification shows that this model is effective.

Key words: Information security, Risk management, Decision-make, Performance