anchor: In selecting organizations to include in our study, we relied primarily on recommendations from the Computer Security Institute and public accounting firms because they were in a position to evaluate and compare information security programs at numerous organizations.
positive: The Computer Security Institute's recommendations helped us choose organizations.
negative: We relied on legal firms to help us find the organizations we were looking for.