premise: The database accounted for the number of information security incidents that had been reported, the types of incidents, and actions taken to resolve each incident, including disciplinary actions.
hypothesis: What disciplinary actions were taken, are not stored in the database.