关键词: 信息安全, 风险评估, 业务流程, 业务风险

Abstract: In order to accurately evaluate the impact to business，which is from the risk of information security，this paper provides a method based on the state changes of business activities.This method explains the impact that the state transition of information system makes the delay of business procedure when this risk is being solved，and makes the delay as a benchmark to evaluate the impact of risk to business.The business procedure delay is one of the most critical indicators.In the end，this paper proves the accuracy of this method by the analysis of example.

Key words: information security, risk evaluation, business process, business risk