The information security awareness is just become priority after data loss or damage happen. This makes the information system user is not ready to solve or minimize the risk that could be happen. Vulnerability assessment or a process to measure the system weaknesses from outsider attack could be the effective way for preventive control implementation against the risk that could be happen. This paper describe how vulnerability assessment as a phase in information security framework, how to perform vulnerability assessment, analyzing the result and how deliver the result to the management and give significant impact for the information technology activity and for the business activity in the company