The entire program of planning for and managing risk to information assets in the organization.