Protection in context
Information security considers who may access information, whether it remains reliable and whether it is available when needed. The significance of these requirements depends on the sensitivity of the data and the activity it supports.
People, processes and technology
Technical controls are one part of security. Professional behavior, defined responsibilities and the way information moves through an organization also affect how risks are understood and managed.