Standard-based security assessment (questionnaire aligned with SANS top 20 critical security controls) to determine the security level by means of interviews