A company's leadership wants to formalize how they identify potential threats to the business, define internal policies that dictate how employees handle data, and ensure the organization meets regulatory requirements such as GDPR. The security team maps these three efforts to a well-known framework. Which set of concepts does this framework represent?