Based on the national standards and codes like "Classified Criteria for Security Protection of Computer Information System", aiming to reduce the enterprise information safety risk to an acceptable level and through the analysis on enterprise information safety demand, this article introduces the basic principle of establishing an enterprise information safety protection system as well as the approach to the selection and implementation of relating information safety control measures.