https://www.sans.org/reading-room/whitepapers/auditing/framework-assessing-20-critical-controls-iso-15504-cobit-5-process-assessment-model-36067