set of rules that regulate how to handle security threats or define the appropriate security level