Law and Framework for Information Security