premise: The organizations we studied had recognized that monitoring control effectiveness and compliance with policies is a key step in the cycle of managing information security.
hypothesis: The groups we looked at realized monitoring control effectiveness was important.