NIST Special Publication 800-39:

Managing Information
Security Risk
Organization, Mission, and Information
System View