Current information security risk assessment models usually focus on the security problems of information system and its environment, however they ignore data changes and the accompanying risks in the whole production process. Aiming at the problems above, the paper analyzes the risks of oil and gas production management system during the different stages of data generation, transmission, processing, storage and demonstration, then proposes a set of data risk assessment model and method focusing on data security. The data risk assessment model provides a new way to prevent intrusion, protect data and safeguard information system’s integrity, availability and security.