Each of the organizations we studied had adopted this view and, within the last few years, primarily since 1993, had established a central security management group or reoriented an existing central security group to facilitate and oversee the organization's information security activities.