As computer becomes popular and internet advances rapidly, information systems are used extensively in organizations. Various information systems such as attendance systems and accounting systems have already replaced manual operations. In such a drastic change, information security risk management issue encountered by organizations becomes increasingly significant. Risk evaluation is the core of information security risk management, and organizations use it to diminish the risks within information systems. Risk evaluation mainly focuses on the assessments of confidentiality, integrity and availability. Moreover, vulnerability of information systems and threats to the outside are also included in the scope of consideration. In this paper, a novel robust algorithm for information security risk evaluation is proposed. In the proposed algorithm, a modified TSK fuzzy model with the robust loss function is used to diminish the influence of noises or outlier first. Furthermore, the I-index is used to determine the best number of fuzzy rules in the proposed algorithm. From simulation results, the proposed algorithm outperforms other existing approaches.