To supplement our ongoing audit work at federal agencies and gain a broader understanding of how information security programs can be successfully implemented, we studied the management practices of eight nonfederal
The management practices of nonfederal agencies were examined.
We weren't really trying to gain a greater understanding of the ways in which information security programs could be implemented.