Any information requires an effective system of protection and is to ensure the sustainable development and functioning of the object. The costs necessary to protect the information are not always justified. Therefore, an important condition for information security is the task of finding the appropriate level of protection at an acceptable cost. The importance of identifying risks in different areas is crucial for the development and stability of enterprises, which makes it possible to understand and assess possible dangerous events, to identify their causes and consequences, the probability of occurrence and decision-making, which is one of the challenges. To do this, it is necessary to conduct an analysis of information security risks, with which it will be possible to assess the existing level of security of resources of any organization. There are various approaches, methods and tools for assessing information security risks, leading to the end result, both with advantages and disadvantages of management. We will evaluate and analyze these methods and identify more acceptable, effective and less costly.