A model of risk assessment was introduced to the estimation of the information system.The method

which combined AHP and fuzzy logical method

was applied to the risk assessment.AHP and fuzzy logical method were altered according to the actual condition of the risk assessment of information system.Applying fuzzy logical method

the im-portant degree of each factor was judged in the aspects of the probability

the impact severity and uncontrollability

not judged immediately.Finally

the risk value of each factor was calculated.By comparing the risk value of each factor

it is known that which risk can take measures to control.By introducing entropy

the proportion of each risk factor in the whole risk assessment system was calculated.Next the risk degree of the whole system was calculated.Then the risk level of the whole system can be determined.The study of the case shows that the model can be easily used to the risk assessment of the information system security.The results are in accord with the reality.