premise: These organizations establish a central management focal point, promote awareness, link policies to business risks, and develop practical risk assessment procedures that link security to business needs.
hypothesis: The organizations handle business security.