statements ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals.
a set of statements prioritizing the information risks, identifying acceptable risk targets, and identifying the mechanisms for achieving these targets
encompasses the database, the dbms, and the applications