1) identifies the organization, its industry, size, locations, and any significant changes underway.

2) Key parts of a security system.

3)A description of risks that may apply to the organization, including specifics on information assets, threats, and vulnerabilities.

4) An explanation of roles, policies, frameworks, standards, and controls.