The practice that aligns security policy with business policy. Heavily involves auditing and Compliance Assessments Concepts CIA Triad E-Discovery Data Classifications Policy Metadata