We focused primarily on the management framework that these organizations had established rather than on the specific controls that they had chosen, because previous audit work had identified security management as an underlying problem at federal agencies.
Federal agencies agreed that the audit work already done had already indicated that security management was a problem.