After initial conversations with a number of organizations, we narrowed our focus to eight organizations that had implemented fairly comprehensive organizationwide information security programs.
After talking to 10 organizations, we decided to focus on the first 5 we'd spoken to.