Unlike many federal agencies, the central groups we studied had defined budgets, which gave them the ability to plan and set goals for their organization's information security program.
Most federal agencies had very crude budgets that would result in profit loss.