In order to carry out the risk quantification for the information system,the risk distribution was proposed based on resources distribution of information system, and the improvement of elements relationship model for risk assessment. In quantifying risks,Analytic Hierarchy Process (AHP), Fuzzy Comprehensive Evaluation (FCE), F-statistic and Least Square Estimation (LSE) was applied to get hierarchy of risk factors. The criteria of relativity and formulated relativity functions were established.