The essential pieces for measuring security program maturity