12550 evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 (16) Guideline: A description that clarifies what should be done and how, to achieve the objectives set out in policies information processing facilities any information processing system, service or infrastructure, or the physical locations housing them. (17) Information System: An electronic information system that processes data electronically through the use of information technology - including but is not limited to: computer systems, servers, workstations, terminals, storage media, communication devices, network resources and Internet. (18) Integrity: When authorized persons are allowed to make changes to the information stored or processed by Information Systems in any aspects. (19) Information security: Preservation of confidentiality, integrity and availability of information; in addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved. (20) Information Security (IS) Policy: A documented list of management instructions that describe in detail the proper use and management of computer and network resources with the objective to protect these resources as well as the information stored or processed by Information Systems from any unauthorized disclosure, modifications or destruction. (21) Information security event: An information security event is an identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant. (22) Information security incident: An information security incident is indicated by a single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security. (23) PKI: PKI is a framework that consists of hardware, software, policies, and procedures for managing keys and certificates. (24) Policy: Overall intention and direction as formally expressed by management. (25) Risk analysis: Systematic use of information to identify sources and to estimate the risk. (26) Risk assessment: Overall process of risk analysis and risk evaluation. (27) Risk evaluation: Process of comparing the estimated risk against given risk criteria to determine the significance of the risk.