In selecting organizations to include in our study, we relied primarily on recommendations from the Computer Security Institute and public accounting firms because they were in a position to evaluate and compare information security programs at numerous organizations.
The Computer Security Institute's recommendations helped us choose organizations.
We relied on legal firms to help us find the organizations we were looking for.