A security manager is documenting the difference between two related governance concepts. Which pairing is included as an explicit sub-topic under the 'Evaluate and apply security governance principles' objective?