General method and process report for information security assessment