Based on the typical risk evaluation flow,this paper advances an effective design project of risk evaluation.In the project,based on the points of risk evaluation as many elements,complex process,difficult implementation and so on,design an ample content information database,include the class and grade information of asset,threat and vulnerability,these can help user to identify and evaluate elements effectively.The project can provide control measures for identified threats,finally,according to the matrix measure,compute the risk value,make user realize the security status of information system clearly and adopt effective control measures.