Information Security Governance: A Process Model and Pilot Case Study