what document is an excellent reference for security managers involved in the routine management of information security?