Information security assessment automation