Abstract: Aiming at the quantifying difficulty of security evaluation for civil aviation information system due to various kinds of evaluation indicators, a standardization method for security evaluation is proposed. Firstly, the evaluation indicators are divided into qualitative and quantitative indicators of compliance degree of security. Then, description tables of compliance degree of security and index matrix tables of compliance degree of security are set for qualitative indicators, quantitative indicators are divided into positive indicators and reverse indicators. Finally, the normalized operator is used to transform the evaluation results into percentile form. The standardization method can provide a relatively intuitive reference for security managers to understand the security status of information systems.

Key words: information system, security evaluation, standardization, compliance degree of security policy