abstract entity representing a managed processing and memory environment that provides protection from code and data that has not been determined to meet established security requirements