The set of laws, rules and practices that regulate how assets including the sensitive information are managed, protected and distributed within a user organization.