Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 3: Security assurance components