Cyber security risk assessment of control system power plant control systems often has strong subjective and uncertainty problems, and these issues will have a certain impact on the assessment results. To solve this problem, a method of information security risk assessment of power plant control systems based on the D-AHP and the TOPSIS is proposed. According to the relevant industry standards for risk assessment of industrial control systems, assets, threats, vulnerabilities and existing safety measures of industrial control systems are identified, and the assessment index system and a hierarchical structure model are established. Aiming at the uncertainty of assessment information caused by the differencesin expert's experience, the D-AHP is used to solve the impact weights of each index. Then the TOPSIS is used to find the expert weight. Finally, the information security risk value of the control system for power plants is obtained. Example analysis shows the effectiveness of the proposed method and the better accuracy of assessment results.