text: The organizations we studied had recognized that monitoring control effectiveness and compliance with policies is a key step in the cycle of managing information security .
  
  ###
  
  The groups we studied knew that they should be sure to have uniform experiments .