At present, interest in the new IT services (Wibro, DMB, VoIP, IPTV, etc) is on the rise, and the government is promoting the IT839 Strategy. Any service provider who wants to provide a new IT service needs to secure appropriate security measures based on a threat and vulnerability analysis from the service planning stage. In addition, the need to prepare countermeasures against the possibility of quality deterioration due to the application of security measures has frequently been pointed out. However, it is difficult to use the existing methodologies to perform a threat and vulnerability analysis that enables the application of the security technology without sacrificing quality (when applied at the planning stage for a new IT service), as these methodologies are only suitable for the information assets of an organization that has already been established. This paper proposes an information security framework capable of identifying security threats at the new IT service planning stage, and of easily identifying the relevance between the security technologies and QoS, so that the security technology can be applied while maintaining the quality of the service.