After initial conversations with a number of organizations , we narrowed our focus to eight organizations that had implemented fairly comprehensive organizationwide information security programs .
After talking to 10 organizations , we decided to focus on the first 5 we 'd spoken to .