organizations recognized as having strong information security programs.
Strong information security programs are features some organizations are known for.
GAO reports have been used to disappointing results.