In an effort to more thoroughly explore this topic, we expanded our discussions beyond the eight organizations that were the primary subjects of our study by requesting the Computer Security Institute to informally poll its most active members on this subject.
The Computer Security Institute is the most helpful organization for this discussion.  