SMS: Information security governance simplified