Evaluation criteria for IT security -- Part 3: Security assurance components