Gaining a Clear View of IT Security in a Health Care Organization