Information technology. Security techniques. Evaluation criteria for IT security - Security assurance requirements