Appendix A – Legal Principles for Information Security Evaluations