An outline process of fitting security within an organization. Defined in the ISO 27001 standard.