https://5dok.net/document/rz316xey-a-framework-for-measuring-organizational-information-security-vulnerability.html