a set of rules and practices that specify how a system or organization provides security services to protect sensitive and critical system resources.
the set of laws, rules, and practices that regulate how an organization manages, protects, and distributes sensitive information.
the document that details exactly how your organization and its data are secured.