24.4 definition of information security assurance system: