Assessment of Enterprise Information Security - The Importance of Prioritization