is a document that states, in writing, how a company plans to protect the company's physical and network assets.
a written document that describes how a system, organization, or other entity is secured.
the researcher controls the allocation of the study subjects to the study group, treated vs non-treated