Understanding industry standards in IT security compliance