Process of identifying, controlling and minimizing or eliminating security risks that may affect information systems, for an acceptable cost.

• 以可接受的费用识别、控制、降低或消除可能影响信息系统的安全风险的过程。