Information security, cybersecurity and privacy protection. Evaluation criteria for IT security - Framework for the specification of evaluation methods and activities