This paper propose a quantitative information security risk metric based on information system security analysis

gap analysis method and its assessment procedure.Through security gap analysis method

we can compute quantitatively the difference between security target and TOE security in security assurance control and security assurance capability

and then improve the information system security architecture design and its assurance level.Using the metric

we can also compare the benefit difference among security contols

and calculate the input-output analysis.This computable information security risk assessment metric and method was applied in real case and proved effective.