premise: After initial conversations with a number of organizations, we narrowed our focus to eight organizations that had implemented fairly comprehensive organizationwide information security programs.
hypothesis: After talking to 10 organizations, we decided to focus on the first 5 we'd spoken to.