evaluate an organisation s compliance with cyber security standards and law