a governance tool for security departments