The Computer Security Institute's recommendations helped us choose organizations.
In selecting organizations to include in our study, we relied primarily on recommendations from the Computer Security Institute and public accounting firms because they were in a position to evaluate and compare information security programs at numerous organizations.