The statement of required protection of the information objects.
Defines the threats that a system shall address and provides high-level mechanisms for addressing those threats.
