Comments sought on information security measurement and eval