A method and system for risk measurement and modeling, which may be used to identify and mitigate information security risks for an information system, and which may improve the efficiency of risk measurement and modeling. Such a system may perform risk modeling based on threat likelihood information, the potential business impacts of particular threats, and data on the effectiveness of particular controls implemented by the operators of the information system, which may be used to calculate residual risk scores for particular risk scenarios that the information system may face.