The process of identifying, evaluating, and prioritizing risks to security, followed by the application of resources to minimize, monitor, and control the probability and impact of those risks.