Providing online, non-downloadable software in the field of information security which automates risk controls and policies in relation to statutory and regulatory requirements