In selecting organizations to include in our study , we relied primarily on recommendations from the Computer Security Institute and public accounting firms because they were in a position to evaluate and compare information security programs at numerous organizations .
The organizations that we selected were all very happy to hear from us .