statements ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals.
statements that prioritize info risk, identify acceptable risks and identify mechanisms for reducing risks
O my god!