Concentrates on defining security controls, policies, and mechanisms to protect the organization's information and technology assets.