The implementation and organization of information safety measures is relevant to costs, so a decision model of information security risk based on expenses constraints is established. An illustrative example is presented to give out an optimal allocation plan for safety measures, which makes the risk and running cost minimum and the operating efficiency highest