The set of laws, rules and practices regulating the processing of sensitive information and the use of resources by the hardware and software of an ITSEC system or product.