statements that prioritize info risk, identify acceptable risks and identify mechanisms for reducing risks
a set of statements prioritizing the information risks, identifying acceptable risk targets, and identifying the mechanisms for achieving these targets
-based on proportions or probabilities for discrete distributions -based on density for continuous distributions  (probability= area under density curve)