We focused primarily on the management framework that these organizations had established rather than on the specific controls that they had chosen, because previous audit work had identified security management as an underlying problem at federal agencies.
The previous audit work was unhelpful in determining whether security management was issue or not in the agencies.