How standards help organizations manage their security