We obtained information primarily through interviews with senior security managers and document analysis conducted during and after visits to the organizations we studied.
Interviews and document analysis are two ways that information was gathered.