Which security concept includes the policy, process, and internal controls comprising how an organization is run - including the structures and policies of the leadership and other mechanisms for…

Governance encompasses the overarching set of policies, procedures, and internal controls that dictate how an organization is directed and controlled. It includes leadership structures, board oversight, and management mechanisms that ensure organizational objectives are met and risks are managed appropriately.

Information security is the practice of protecting information assets from unauthorized access or disclosure - a subset of organizational activity, not the overarching management framework.

Enterprise risk management is the process of identifying, assessing, and mitigating risks across an organization, which is one element governed by the broader governance framework.

Information risk management specifically focuses on risks related to information assets, a narrower domain than governance as a whole.

Compliance refers to adherence to specific laws, regulations, and standards - an output or component of a governance program rather than governance itself.