SMS: Assessing information security