Evaluation criteria for IT security -- Part 2: Security functional components