based on activities and items associated with information security