The workflows, procedures and institutional know-how the organisation depends on to deliver its product or service — whether formally documented or simply “how we've always done it”.

Undocumented processes are themselves a risk: if the process only exists in someone's head, protecting it means protecting that person's availability (see Personnel & key know-how) rather than protecting the process itself.