The organizations we studied had recognized that monitoring control effectiveness and compliance with policies is a key step in the cycle of managing information security.
The groups we looked at realized monitoring control effectiveness was important.
The groups we studies were unaware of their need to monitor control effectiveness.