Describir: Assessing information security