The protection requirement describes what protection is sufficient and appropriate for the business processes, the information processed in the process and the information technology used.