characteristics of standard information security assurance