Security management is the identification of an organization's assets (including information assets)  followed by the development  documentation  and implementation of policies and procedures for protecting these assets An organization uses such security management procedures as information classification  risk assessment  and risk analysis to identify threats  categories assets  and rate system vulnerabilities so that they can implement effective controls and prevention of losses