Assessment and assurance for cyber